Observed-source gate
Evidence gatedINFERRED, UNKNOWN, simulated, or otherwise non-observed rows do not enter deterministic matches. No telemetry is not interpreted as no threat.
Threat detection / continuous validation
Detect the signal. Preserve the proof. Control the response.
ELITZE's threat-detection path evaluates authenticated tenant security events marked OBSERVED. Rules prioritize source-authored high-impact alerts, correlated authentication failures, explicit credential/exfiltration signals, and sensitive-tool policy denials. Results include source references and event IDs for investigation.
Control plane
Built for evidence-first security operations
Unavailable integrations are labeled not configured. Missing evidence is described as not verified or not measurable.
Authentication failure clustering
Deterministic ruleThree or more source-identified authentication failures for the same subject are correlated within a 30-minute window. The rule recommends review; it does not automatically block an identity.
Explicit exfiltration / credential signals
Source boundedOnly source-authored indicators that explicitly name credential exposure or exfiltration can trigger the rule. Generic network activity is not labelled exfiltration.
MCP/tool policy denial
Control evidenceA recorded denial is preserved as a possible successful control outcome—not treated as proof that an attack succeeded.
MITRE ATT&CK context
Official dataTechnique details are fetched from the official Enterprise STIX dataset. An ATT&CK identifier supplied by a source is kept distinct from a technique inferred from a rule.
3D evidence globe
Observed coordinates onlyInteractive globe markers appear only when an observed source record provides valid latitude and longitude. The grid and sphere are visual context, not security telemetry.
Related capabilities
Live detection consoleInspect actual tenant-scoped matches, sources, and evidence state.ATT&CK technique catalogueAuthenticated query over the current MITRE Enterprise dataset.Adversary emulationBuild authorised, scoped validation plans informed by ATT&CK.Security graphTrace observed identity-to-tool reachability and policy boundaries.
ELITZE does not claim a clean posture when telemetry is absent. Live source records, authorization scope, execution state, and verification evidence remain separately visible.